Argo Workflows dashboard is accessible without authentication. Argo Workflows is a Kubernetes-native workflow engine that can execute arbitrary containers and commands. Unauthenticated access allows viewing, creating, and modifying workflows.
id: argo-workflows-unauth
info:
name: Argo Workflows - Unauthenticated Dashboard
author: 0xBassia
severity: high
description: |
Argo Workflows dashboard is accessible without authentication. Argo Workflows is a Kubernetes-native workflow engine that can execute arbitrary containers and commands. Unauthenticated access allows viewing, creating, and modifying workflows.
impact: |
An attacker can view all workflow executions and their logs (potentially containing secrets), submit new workflows that execute arbitrary containers in the Kubernetes cluster, and access service account tokens for further cluster exploitation.
remediation: |
Configure Argo Workflows SSO authentication or set --auth-mode=server in the argo-server deployment. Apply Kubernetes RBAC policies to restrict workflow creation.
reference:
- https://argo-workflows.readthedocs.io/en/latest/argo-server-auth-mode/
- https://argo-workflows.readthedocs.io/en/latest/argo-server-sso/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
cvss-score: 9.4
cwe-id: CWE-306
metadata:
verified: true
max-request: 1
shodan-query: title:"Argo Workflows"
tags: misconfig,argo,kubernetes,unauth,workflow
http:
- method: GET
path:
- '{{BaseURL}}/api/v1/workflows/argo'
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"metadata"'
- '"items"'
condition: and
- type: word
part: header
words:
- "application/json"
- type: status
status:
- 200
# digest: 4b0a004830460221008eea12d714421f82dbea9ce90333d9f64875ca4f2dd43da0ced9e739fe85c3b9022100e212bf4c09eb4df846e6f32f1015922bb882e5e26935a4355cddf358712b4748:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.